# MCP Census, mcp-scan (Snyk Agent Scan) and Cisco MCP Scanner

These tools answer different questions. The MCP Census is a first gate on public evidence before you install a server, not a security audit. mcp-scan (now Snyk Agent Scan) and Cisco MCP Scanner connect to servers you have chosen and analyse their tool descriptions or code.

Page owner: Jaco Veldsman, The MCP Census, Australia. info@mcpcensus.com.
Checked 21 October 2026.

## Facts

| | The MCP Census | mcp-scan / Snyk Agent Scan | Cisco MCP Scanner |
|---|---|---|---|
| Made by | Jaco Veldsman, Australia. | Snyk. Published first as mcp-scan by Invariant Labs; [the old repository](https://github.com/invariantlabs-ai/mcp-scan) redirects to [snyk/agent-scan](https://github.com/snyk/agent-scan). | Cisco AI Defense ([cisco-ai-defense/mcp-scanner](https://github.com/cisco-ai-defense/mcp-scanner)). |
| Licence | Hosted service. The API contract is public. | Apache-2.0 ([PyPI](https://pypi.org/project/snyk-agent-scan/)). | Apache-2.0 ([README badge](https://github.com/cisco-ai-defense/mcp-scanner)). |
| Question it answers | Does the public record support installing this exact server? | Do the tool descriptions and skills on this machine show known risks? | Do this server’s tools, prompts, resources or code show security findings? |
| What it checks | Publisher identity, official versus lookalike names, repository and package health, advisories, whether a hosted endpoint answers. No tool-description analysis. | v0.6 and later report scored risk indicators such as prompt injection, untrusted or private data exposure, destructive capabilities and malicious skills ([risk reference](https://github.com/snyk/agent-scan/blob/main/docs/risks.md)). It covers MCP servers, tools, prompts, resources and skills. | YARA rules, an LLM-based analyzer and the Cisco AI Defense inspect API over tools, prompts, resources and server instructions. It can also scan server source code, PyPI and npm packages, Python dependencies for known vulnerabilities, and binaries through VirusTotal hash lookups. |
| How you run it | Web lookup, REST, or MCP. Command below. | `uvx snyk-agent-scan@latest`, or a standalone binary from [GitHub Releases](https://github.com/snyk/agent-scan/releases). | `uv tool install cisco-ai-mcp-scanner`, then `mcp-scanner`. |
| What it needs | Nothing for the keyless allowance. A free account key raises the limits. | A Snyk API token in `SNYK_TOKEN`, and uv or the binary. | Python 3.11+ and uv. A Cisco AI Defense API key, an LLM provider key and a VirusTotal key are each optional. The README requires a key only for the API and LLM analyzers; its quick-start examples use the YARA analyzer. |
| Does it connect to or run servers | It does not install or run your servers. For a hosted endpoint it records whether a public handshake answers. | Yes. It starts stdio servers by running the config’s commands, after consent in interactive runs, and connects to remote URLs with the configured headers. The README says to run it in a sandbox for untrusted configs. | Yes for live scans: it connects to remote HTTP/SSE servers and launches stdio servers. A static mode scans pre-generated JSON files offline. |
| CI | [GitHub Action](/agent-setup/census-preflight.yml): BLOCK fails the job. | `--ci` exits non-zero when findings or operational failures remain. Its README example is `snyk-agent-scan --ci --dangerously-run-mcp-servers`. | The README describes static mode as suited to CI/CD pipelines and air-gapped environments. |
| Where your data goes | The config’s `url`, `command`, `args` and `type` are read; `env` and headers are ignored and never stored. Strip them before posting. | Agent application details, MCP server configurations and signatures, tool names and descriptions, and skill content are sent to the Agent Scan API, with secrets redacted. | The README has no data-handling statement. Check what each analyzer receives before you enable it. |

## Run each one

Census, audit your .mcp.json with no account:

```
jq '.mcpServers |= map_values({url, command, args, type})' .mcp.json \
  | curl -s -X POST https://api.mcpcensus.com/v1/audit \
      -H 'content-type: application/json' -H 'accept: text/plain' --data @-
```

Snyk Agent Scan, needs a Snyk token:

```
export SNYK_TOKEN=your-api-token-here
uvx snyk-agent-scan@latest
```

Cisco MCP Scanner, YARA analyzer:

```
uv tool install --python 3.13 cisco-ai-mcp-scanner
mcp-scanner --scan-known-configs --analyzers yara --format summary
```

The Census command strips env and headers before posting and reads one config of up to 25 entries per IP per UTC day without a key. Contract: https://mcpcensus.com/agent-setup/audit.md. Both scanner commands connect to the servers in your configs, which for stdio servers means starting them, so use a sandbox for configs you do not trust.

## When to use which

- Before you install: use the Census to check publisher, official versus lookalike, repository and package health, advisories and hosted liveness. Nothing is run.
- After you have chosen a server: use a scanner on it, in a sandbox, to read tool descriptions or code.
- Together: Census first, scanner second, then your own review. See https://mcpcensus.com/learn/check-mcp-server-safe and https://mcpcensus.com/learn/census-stamp-vs-mcp-scan.

## What the Census does not do

- It is not a malware lab and runs no antivirus or YARA pack over the catalog.
- It has no tool-poisoning or prompt-injection classifier.
- It does not review permissions, scopes or data use.
- PASS is not safe. UNKNOWN means the Census holds no row, not that the entry is fine.

## Questions

### Is the MCP Census a replacement for mcp-scan or Cisco MCP Scanner?

No. The Census reads public evidence about a server (who publishes it, whether the repository and packages exist, advisories, whether a hosted endpoint answers) and returns PASS, REVIEW, BLOCK or UNKNOWN before you install. The scanners connect to a server or read its code and analyse tool descriptions. Use the Census first, then a scanner on the servers you keep.

### Is mcp-scan the same tool as Snyk Agent Scan?

Yes. On the check date, github.com/invariantlabs-ai/mcp-scan redirected to github.com/snyk/agent-scan, and the PyPI page for mcp-scan 0.4.3 said the package had been renamed to snyk-agent-scan and forwards the mcp-scan command.

### Does scanning an MCP config run the servers in it?

With Snyk Agent Scan it can. Its README says it starts stdio servers by executing the commands in the config and connects to remote URLs with the configured headers, asks for consent in interactive runs, and recommends a sandbox. Cisco MCP Scanner also launches and connects to stdio and remote servers, and has an offline static mode that reads pre-generated JSON files instead. The Census does not install or run your servers.

### Does a Census PASS mean a server is safe to run?

No. PASS means the public evidence meets the named policy. It is not a malware scan, a permission review or a sandbox. Review the tools and the secrets a server asks for, and run a scanner in a sandbox if you want a second look.

## Sources read on 21 October 2026

- Snyk Agent Scan README (github.com/snyk/agent-scan): https://github.com/snyk/agent-scan
- Snyk Agent Scan risk reference (docs/risks.md): https://github.com/snyk/agent-scan/blob/main/docs/risks.md
- Cisco MCP Scanner README (github.com/cisco-ai-defense/mcp-scanner): https://github.com/cisco-ai-defense/mcp-scanner
- github.com/invariantlabs-ai/mcp-scan, which redirects to snyk/agent-scan: https://github.com/invariantlabs-ai/mcp-scan
- PyPI: mcp-scan 0.4.3, renamed to snyk-agent-scan: https://pypi.org/project/mcp-scan/
- PyPI: snyk-agent-scan (latest 0.6.9, Apache-2.0): https://pypi.org/project/snyk-agent-scan/
- PyPI: cisco-ai-mcp-scanner 4.8.7 (Apache-2.0): https://pypi.org/project/cisco-ai-mcp-scanner/